Computer networks and systems have become indispensable tools for modern business. Modern enterprises use such networks for communications and for storage. The information and data stored on the network of a business enterprise is often a highly valuable asset. Modern enterprises use numerous tools to keep outsiders, intruders, and unauthorized personnel from accessing valuable information stored on the network. These tools include firewalls, intrusion detection systems, and packet sniffer devices.
FIG. 1 illustrates a simple prior art configuration of a local area network (LAN) 100 connected to the Internet 102. Connected to the LAN 100 are various components, such as servers 104, clients 106, and switch 108. Numerous other networking components and computing devices are connectable to the LAN 100. The LAN 100 may be implemented using various wireline or wireless technologies, such as Ethernet and the 802.11 the IEEE family of wireless communication standards. LAN 100 could be connected to other LANs.
In this prior configuration, the LAN 100 is connected to the Internet 102 via a router 110. This router 110 may be used to implement a firewall. Firewalls are widely used to try to provide users of the LAN 100 with secure access to the Internet 102 as well as to provide separation of a public Web server (for example, one of the servers 104) from an internal network (for example, LAN 100). Data leaving the LAN 100 to the Internet 102 passes through the router 110. The router 110 simply forwards packets as is from the LAN 100 to the Internet 102.
However, once an intruder has gained access to sensitive content inside a LAN such as LAN 100, there presently is no network device that can prevent the electronic transmission of the content from the network to outside the network. Similarly, there is no network device that can analyse the data leaving the network to monitor for policy violations, and make it possible to track down information leeks.
Networked computers (such as computers connected on a LAN or through the Internet) utilize addressing to communicate. A packet of data may be routed to a specific computer that is identified by a particular Internet Protocol (IP) addresses. For example, an internet browser uses the IP address of 64.236.16.20 has the location to send and receive requests from CNN.com. (The Domain Name System (using a Domain Name Server or DNS) is generally used to translate a URL such as CNN.com into an IP address.)
Media Access Control (MAC) addresses are unique identifiers for individual pieces of networking equipment. For example, each Ethernet and 802.11 wireless card has a unique MAC address. The combination of IP and MAC addresses provide a mechanism to determine which computer and/or user has performed some sort of activity on the Internet or Intranet.
The current IP standard is IP version 4 (or IPv4). An IP address in IPv4 is a four-byte (32-bit) number combination in the format of AAA.BBB.CCC.DDD. For example, 64.236.16.20 is the IPv4 address for CNN.com. IP addresses are public, private, or multicast. Public IP addresses are available to the outside world for direct access. For example, the IP address given above for CNN.com is a public address. Private IP addresses are reserved for internal/private networks. For example, IP addresses assigned by a router to individual computers on a LAN are private, whereas the IP address of the router itself is generally public. Exemplary private IP address spaces are 10.0.0.0-10.255.255.255; 172.16.0.0-172.31.255.255; and 192.168.0.0-192.168.255.255.
On a LAN, private IP addresses are assigned to individual computers and/or NICs. A common way to assign a private IP address to a computer and/or NIC is to use a Dynamic Host Configuration Protocol (DHCP) server. A DHCP server allocates an IP address to a client in one of three ways: manual allocation, automatic allocation, or dynamic allocation.
For manual allocation, a DHCP server allocates an IP address based on a table of MAC and IP address pairs. This table is manually created by the server administrator. Essentially, the IP address is statically assigned to a MAC address until the administrator changes it and only MAC address in the table are able to get an IP address. Typically, the client must know of the IP address that is available to it. While this may work well for a small network with few devices that do not change, it does not scale well to larger networks or networks with changing devices due to the need to update the table.
Using manual allocation, an administrator sets a range of IP addresses that may be assigned. The DHCP server “permanently” assigns an IP address from this range to a client. Typically, the client must know of the IP address that is available to it. This again requires some administrative maintainence.
The third DHCP assignment technique is dynamic allocation. The DHCP server “leases” an IP address from a range of IP address allocated by an administrator to a NIC that requests one. After a pre-determined amount of time (such as five days, one day,. etc.) the lease on the IP address expires and the NIC must request a new IP address from the DHCP server. This leasing technique allows for the dynamic reallocation of IP addresses. For example, a DHCP server may lease an first IP address to a particular NIC for a period of one day on a Monday and on Tuesday assign a second (and different) IP address the same NIC while re-assigning the first IP address to a different NIC. Generally, the DHCP server attempts to assign the same IP address to the same MAC but this is not always possible.
FIG. 2 illustrates an exemplary communication between computers through a network. Computers A 201, B 205, and C 209 each have a unique IP address and a NIC card 203, 207, and 211 with a unique MAC address. The IP addresses of computers B 205 and C 209 have been assigned by router 213. As described earlier, these IP addresses could be dynamically, manually, or automatically assigned. Router 213 also as its own unique IP address which is accessible by computer A through the network 215.
Computer A 201 communicates to computers B 205 and C 209 through the router 213. The router 213 is connected to the network with a single public address or multiple public addresses. As packets move from a computer to the network 215, the source address in each packet is translated from the private addresses to the public address(es). The router 213 tracks basic data about each active connection (such as the destination address and port). When a reply returns to the router 213, it uses the connection tracking data it stored during the outbound phase to determine which computer (B 205 or C 209) to forward the reply.